AlinsRan commented on PR #2882:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2882#issuecomment-6078072769
Unblocked and out of draft: ADC v0.31.0 shipped today and carries the two
fields this PR needs.
Both CI paths pin ADC separately and both are bumped:
```make
# Makefile — the conformance job, via kind-load-adc-image
ADC_VERSION ?= 0.31.0
```
```yaml
# .github/workflows/apisix-e2e-test.yml — the e2e jobs, Rust binary from the
release tarball
ADC_RUST_VERSION: "0.31.0"
```
Verified each flavour against the same stream-route config, with the old pin
as a control:
| | 0.30.5 (old pin) | 0.31.0 |
|---|---|---|
| Node image (`ghcr.io/api7/adc`) | `Unrecognized keys: "snis",
"tls_passthrough"` | `success Lint configuration` |
| Rust binary (release tarball) | `unknown field 'snis', expected one of ...
'sni'` | `success Loading local configuration` |
A third pin moved for a related reason:
```make
# 3.19.0 is the first APISIX release carrying apache/apisix#13912
CONFORMANCE_DATAPLANE_VERSION ?= 3.19.0-debian
```
When this PR was opened no release carried the `stream_proxy
tls_passthrough` listen, so the note here said a release conformance report had
to wait for one. 3.19.0 (2026-09-28) ships it — `apisix/cli/ngx_tpl.lua`,
`apisix/schema_def.lua` and `apisix/stream/router/ip_port.lua` all have it — so
a release report can now include the Passthrough tests.
## Conformance, against both released artifacts
`PROVIDER_TYPE=apisix`, `apache/apisix:3.19.0-debian`,
`ghcr.io/api7/adc:0.31.0`, experimental channel:
| Profile | Core | Extended |
|---|---|---|
| GATEWAY-HTTP | 32 passed, 0 failed, 5 skipped | 12 passed, 0 failed, 1
skipped |
| GATEWAY-GRPC | 15 passed, 0 failed, 0 skipped | 1 passed, 0 failed, 0
skipped |
| GATEWAY-TLS | **19 passed, 0 failed, 1 skipped** | 3 passed, 0 failed, 1
skipped |
Suite exits 0, no profile reports `result: failure`. GATEWAY-TLS core goes
from 16 passed / 4 skipped on master to 19 passed / 1 skipped, and every
GATEWAY-HTTP skip was already there — the 443 remapping caused no regression.
The one remaining GATEWAY-TLS skip is `TLSRouteHostnameIntersection`, and it
is in `skippedTestsForKnownGaps` with the reasoning recorded. Short version:
the test stands four Gateways up on port 443 with different listener hostnames,
every Gateway resolves to the one data plane address and the one physical
stream listen, and the Gateway whose listener carries no hostname keeps its
route's `*.com` verbatim — correctly, its own subtest depends on it — which
then also answers `non.matching.com` on the address of the Gateway that should
have rejected it. Which Gateway a connection was addressed to is not on the
wire. Every other assertion in that test passes, including all the hostname
intersections.
## Rebased onto master twice since
Most recently `#2876` gave `buildL4StreamRoutes` an error return and inlined
the port-set computation, superseding the helper this series had extracted:
```go
// internal/adc/translator/tlsroute.go
streamRoutes, err := t.buildL4StreamRoutes(tctx, tlsRoute.Namespace,
tlsRoute.Name, ruleIndex, "TLS", "TLSRoute", labels)
if err != nil {
return nil, err
}
for _, streamRoute := range streamRoutes {
if len(snis) == 1 {
streamRoute.SNI = snis[0]
} else {
streamRoute.SNIs = snis
}
if tlsPassthroughOnPort(tctx.Listeners, streamRoute.ServerPort) {
streamRoute.TLSPassthrough = ptr.To(true)
}
}
```
One set of stream routes per rule carrying every SNI, rather than master's
loop over hostnames — `buildL4StreamRoutes` names routes by rule and port only,
so N hostnames produced N sets sharing one ID and only the last survived. The
now-unused `l4StreamRoutePorts` is gone.
`go build`, `go vet`, `make lint` (0 issues) and `go test ./internal/...`
are clean.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
